Root Cause Analysis Based on Process Optimization Data

ABSTRACT

A system for root cause analysis based on process optimization data is provided. The system receives log data associated with a first trace between a first activity and a second activity of a process. The system further determines a state of inefficiency between the first activity and the second activity based on the received log data. The system further applies a first machine learning (ML) model on the received log data. The system further determines a first label and a first value to be associated with the first trace of the process based on the application of the first ML model. The system further generates presentation data associated with the determined state of inefficiency of the first trace based on the determination of the first label and the first value and further transmits the generated presentation data on a user device.

FIELD

Various embodiments of the disclosure relate to detection of root causefor inefficiencies in a process. More specifically, various embodimentsof the disclosure relate to a system and a method for root causeanalysis based on process optimization data in the process.

BACKGROUND

Due to dynamic nature of an organization, the organization may havemultiple processes. A process can be defined as an activity or a set ofactivities that can accomplish a specific organizational goal. Forexamples, the processes in a banking industry may be, but is not limitedto, a customer on-boarding process, a credit check process, adeposit-withdrawal process, and so on. With continuous increment in acount and complexity of the processes in the organization, theorganization generally creates process flows from historical dataassociated with the processes. The process flows may enable theorganization to monitor and quickly discover inefficiencies (or otherproblems) within the processes. These inefficiencies may result inreputational as well as financial losses to the organizations. Once theinefficiencies are discovered, the organizations may also be interestedin detection of a root cause for the inefficiencies.

Current methodology for detection of the root cause for inefficienciesmay involve manual effort where the organization usually rely on humanconsultants who attempt to detect the root cause of the inefficienciesbased on analysis of the historical data associated with the processes.This manual methodology may be time-consuming, expensive, as well assubjected to human errors. Therefore, there is required a system thatmay be capable to detect the root cause of the inefficiencies in theprocess accurately, quickly, as well as in an in-expensive manner.

Limitations and disadvantages of conventional and traditional approacheswill become apparent to one of skill in the art, through comparison ofdescribed systems with some aspects of the present disclosure, as setforth in the remainder of the present application and with reference tothe drawings.

SUMMARY

A system and method for root cause analysis based on processoptimization data is provided substantially as shown in, and/ordescribed in connection with, at least one of the figures, as set forthmore completely in the claims.

These and other features and advantages of the present disclosure may beappreciated from a review of the following detailed description of thepresent disclosure, along with the accompanying figures in which likereference numerals refer to like parts throughout.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram of an exemplary network environment for root causeanalysis based on process optimization data, in accordance with anembodiment of the disclosure.

FIG. 2 is a block diagram of a system for root cause analysis based onprocess optimization data, in accordance with an embodiment of thedisclosure.

FIG. 3 is a diagram that depicts an exemplary flow map of a process, inaccordance with an embodiment of the disclosure.

FIG. 4 depicts a block diagram that illustrates a set of operations forroot cause analysis based on process optimization data, in accordancewith an embodiment of the disclosure.

FIG. 5 depicts a block diagram that illustrates a first set ofoperations for training of a first ML model, in accordance with anembodiment of the disclosure.

FIG. 6 depicts a block diagram that illustrates a second set ofoperations for training of a first ML model of FIG. 5 , in accordancewith an embodiment of the disclosure.

FIG. 7 is a diagram that displays an exemplary presentation data, inaccordance with an embodiment of the disclosure.

FIG. 8 is a flowchart that illustrates an exemplary method for rootcause analysis based on process optimization data, in accordance with anembodiment of the disclosure.

DETAILED DESCRIPTION

The following described implementations may be found in the disclosedsystem and method for root cause analysis based on process optimizationdata (or process mining data). The process mining data may be associatedwith a process. The process may correspond to an activity or a set ofactivities that may accomplish a specific organizational goal. Forexample, the set of activities may include (but is not limited to) afirst activity and a second activity. Each activity of the set ofactivities may include a set of tasks that may be completed to completethe corresponding activity. The process may have a specific well-definedstarting point and a specific well-defined ending point. Each process inthe organization may be unique, and may have different levels ofcriticality, impact, and must be managed with a comprehensive lifecycle.

Once the process executes, the system may record event data associatedwith the set of tasks or the set of activities of the process. Variousorganizations may analyze the recorded event data to gain variousinsights about the process. In some scenarios, the recorded event datamay be analyzed to detect one or more inefficiencies between at leasttwo activities (such as the first activity and the second activity) ofthe process. For example, the inefficiencies may correspond toadditional time taken to complete certain task related to at least twoactivities. These inefficiencies may further incur reputational as wellas financial losses to the organization.

Once the inefficiencies are detected, the organizations (or processowners within the organizations) may wish to detect the root causebehind the one or more inefficiencies. Traditional methods for detectionof one or more root causes may rely on human consultants who may apply aseries of pre-defined steps to detect the root cause and possiblyprovide one or more suggestions to overcome the one or more root causeswithin the process. However, these traditional manual methods fordetection of the one or more root causes are time consuming, expensive,and subjected to human error as well.

The disclosed system may be configured to automatically detect the rootcause for the one or more inefficiencies within the process (for exampleat a click of a button). The disclosed system may apply a machinelearning (ML) model on log data (i.e. that may include the event data)to automatically detect one or more root causes for inefficiencieswithin the process. Thus, the disclosed system may detect the root causefor the inefficiencies in the processes quickly, accurately, and atlesser cost as compared to traditional methodologies. Moreover, thedisclosed system may determine an impact of the inefficiencies onoverall outcome of the process. Also, the disclosed system may becapable to automatically provide one or more suggestions to overcome theinefficiencies. The disclosed system may further render the detectedroot causes, determined impact, and the determined one or moresuggestions in a natural language so that an end-user may easilyunderstand the detected root causes, the determined impact, and the oneor more suggestions quickly and effectively.

Exemplary aspects of the disclosure provide a system that may include aprocessor. The system may receive log data associated with a tracebetween a first activity and a second activity of a process. The tracemay correspond to a sequence of operations executed between the firstactivity and the second activity of the process. The system may befurther configured to determine a state of inefficiency between thefirst activity and the second activity based on the received log data.The system may be further configured to apply the machine learning (ML)model on the received log data based on the determined state ofinefficiency. The system may be further configured to determine a labeland a value to be associated with the trace of the process based on theapplication of the ML model. The label and the value may indicateinformation about a root cause for the determined state of inefficiency.The system may be further configured to generate presentation dataassociated with the determined state of inefficiency of the first tracebased on the determination of the label and the value, and furthertransmit the generated presentation data to a user device.

Example methods, devices, and systems are described herein. It should beunderstood that the words “example” and “exemplary” are used herein tomean “serving as an example, instance, or illustration.” Any embodimentor feature described herein as being an “example” or “exemplary” is notnecessarily to be construed as preferred or advantageous over otherembodiments or features unless stated as such. Thus, other embodimentscan be utilized, and other changes can be made without departing fromthe scope of the subject matter presented herein.

Accordingly, the example embodiments described herein are not meant tobe limiting. It will be readily understood that the aspects of thepresent disclosure, as generally described herein, and illustrated inthe figures, can be arranged, substituted, combined, separated, anddesigned in a wide variety of different configurations. For example, theseparation of features into “client” and “server” components may occurin a number of ways. Further, unless context suggests otherwise, thefeatures illustrated in each of the figures may be used in combinationwith one another. Thus, the figures should be generally viewed ascomponent aspects of one or more overall embodiments, with theunderstanding that not all illustrated features are necessary for eachembodiment.

Additionally, any enumeration of elements, blocks, or steps in thisspecification or the claims is for purposes of clarity. Thus, suchenumeration should not be interpreted to require or imply that theseelements, blocks, or steps adhere to a particular arrangement or arecarried out in a particular order.

FIG. 1 is a diagram of an exemplary network environment for root causeanalysis based on process optimization data, in accordance with anembodiment of the disclosure. With reference to FIG. 1 , there is showna block diagram of a network environment 100. The network environment100 may include a system 102, a user device 104, a first machinelearning (ML) model 106, and a server 108. The system 102 may beconfigured to communicate with the user device 104 and the server 108,through a communication network 110. With reference to FIG. 1 , there isfurther shown a user 112 associated with the user device 104 andpresentation data 114 that may be displayed on an electronic userinterface (UI) 116 of the user device 104.

The system 102 may include suitable code, logic, circuitry, and/orinterfaces that may be configured to detect root cause for inefficiencyin a process. The system 102 may receive log data associated with afirst trace between a first activity and a second activity of theprocess of an organization and further apply the first ML model 106 onthe received log data. The system 102 may further determine a firstlabel and a first value to be associated with the first trace of theprocess based on the application of the first ML model 106. The firstlabel and the first value may indicate information about a root causefor a state of inefficiency between the first activity and the secondactivity. The system 102 may be further configured to generate thepresentation data 114 associated with the determined state ofinefficiency of the first trace based on the determination of the firstlabel and the first value. The system 102 may further transmit thegenerated presentation data 114 to the user device 104. Examples of thesystem 102 may include, but are not limited to, a process optimizationengine, a workstation, a laptop, a server, a cluster of servers with amanagement panel, a tablet, an internet-enabled device, a desktopcomputer, a smart phone, or any portable or non-portable device with anetworking and processing capability. In some embodiments, the system102 may store the first machine learning (ML) model 106.

The user device 104 may include suitable logic, circuitry, andinterfaces that may be configured to receive the presentation data 114and further render the received presentation data 114 on the electronicUI 116 of the user device 104. In an embodiment, the user device 104 maybe further configured to transmit the log data to the system 102. Theuser device 104 may be associated with the user 112 of the organization.In an embodiment, the user 112 may be a process manager or a processowner of the process within the organization. Examples of the userdevice 104 may include, but are not limited to, a workstation, a laptop,a server, a cluster of servers with a management panel, a tablet, aninternet-enabled device, a desktop computer, a mobile phone, or anyportable or non-portable device with a networking, processing, anddisplay capability.

The first machine learning (ML) model 106 may be a classifier which maybe trained to identify a relationship between inputs, such as featuresin a training dataset and output labels, such as human defined labels.The first ML model 106 may be defined by its hyper-parameters, forexample, number of weights, cost function, input size, number of layers,and the like. The hyper-parameters of the first ML model 106 may betuned and weights may be updated so as to move towards a global minimaof a cost function for the first ML model 106. After several epochs ofthe training on the feature information in the training dataset, thefirst ML model may be trained to output a prediction/classificationresult for a set of inputs. The prediction result may be indicative ofthe label for each input of the set of inputs (e.g., input featuresextracted from new/unseen instances).

The first ML model 106 may include electronic data, which may beimplemented as, for example, a software component of an applicationexecutable on the system 102. The first ML model 106 may rely onlibraries, external scripts, or other logic/instructions for executionby a processing device, such as the processor. The first ML model 106may include code and routines configured to enable a computing device,such as the processor (of FIG. 2 ) to perform one or more operations fordetermination of the label (i.e. root cause) and a corresponding valuefor each trace of the process. Thus, the first ML model 106 may betrained to associate the label (and corresponding values) with differenttraces (i.e. indicating different problems like inefficiencies) in theprocess. Additionally or alternatively, the first ML model 106 may beimplemented using hardware including a processor, a microprocessor(e.g., to perform or control performance of one or more operations), afield-programmable gate array (FPGA), or an application-specificintegrated circuit (ASIC). Alternatively, in some embodiments, the firstML model 106 may be implemented using a combination of hardware andsoftware.

The server 108 may include suitable logic, circuitry, and interfaces,and/or code that may be configured to store the log data. The server 108may be further configured to train and store the first ML model 106. Insome embodiments, the server 108 may be further configured to store thegenerated presentation data 114. The server 108 may be implemented as acloud server and may execute operations through web applications, cloudapplications, HTTP requests, repository operations, file transfer, andthe like. Other example implementations of the server 108 may include,but are not limited to, a database server, a file server, a web server,a media server, an application server, a mainframe server, or a cloudcomputing server.

In at least one embodiment, the server 108 may be implemented as aplurality of distributed cloud-based resources by use of severaltechnologies that are well known to those ordinarily skilled in the art.A person with ordinary skill in the art will understand that the scopeof the disclosure may not be limited to the implementation of the server108 and the system 102 as two separate entities. In certain embodiments,the functionalities of the server 108 can be incorporated in itsentirety or at least partially in the system 102, without a departurefrom the scope of the disclosure.

The communication network 110 may represent a portion of the globalInternet. However, the communication network 110 may alternativelyrepresent different types of network, such as a private wide-area orlocal-area packet-switched networks. The communication network 110 mayinclude a communication medium through which the system 102, the userdevice 104, and the server 108 may communicate with each other. Thecommunication network 110 may be one of a wired connection or a wirelessconnection. Examples of the communication network 110 may include, butare not limited to, the Internet, a cloud network, a Wireless Fidelity(Wi-Fi) network, a Personal Area Network (PAN), a Local Area Network(LAN), or a Metropolitan Area Network (MAN). Various devices in thenetwork environment 100 may be configured to connect to thecommunication network 110 in accordance with various wired and wirelesscommunication protocols. Examples of such wired and wirelesscommunication protocols may include, but are not limited to, at leastone of a Transmission Control Protocol and Internet Protocol (TCP/IP),User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), FileTransfer Protocol (FTP), Zig Bee, EDGE, IEEE 802.11, light fidelity(Li-Fi), 802.16, IEEE 802.11s, IEEE 802.11g, multi-hop communication,wireless access point (AP), device to device communication, cellularcommunication protocols, and Bluetooth (BT)® communication protocols.

In operation, the system 102 may be configured to receive log dataassociated with the first trace (i.e. sequence of related operations orsteps) between the first activity and the second activity of theprocess. The received log data may include a first set of records, afirst set of logs, and a first set of user events associated with thefirst trace between the first activity and the second activity. Based onthe reception of the log data, the system 102 may be configured todetermine a state of inefficiency between the first activity and thesecond activity of the process or the state of inefficiency in the firsttrace. The determine state of inefficiency may be potential candidatefor delays, reputational losses, as well as financial losses incurred byan organization associated with the process. The state of inefficiencybetween the first activity and the second activity of the process may bedetermined based on a plurality of criteria. Details about thedetermination of the state of inefficiency are provided, for example, inFIG. 3 .

The system 102 may be further configured to apply the first ML model 106on the received log data based on the determined state of inefficiency.Based on the application of the first ML model 106 on the received logdata, the system 102 may be configured to determine a first label and afirst value to be associated with the first trace of the process. Thefirst label and the first value may indicate information about a rootcause for the determined state of inefficiency between the firstactivity and the second activity. Details about the application of thefirst ML model 106 on the log data are provided, for example, in FIG. 5and FIG. 6 .

The system 102 may be further configured to generate the presentationdata 114 associated with the determined state of inefficiency of thefirst trace based on the determination of the first label and the firstvalue. The generated presentation data 114 may include one or more rootcauses for the determined state of inefficiency between the firstactivity and the second activity and an impact of the inefficiency onthe process. The generated presentation data 114 may further include oneor more suggestions to overcome the inefficiency between the firstactivity and the second activity. The system 102 may be furtherconfigured to transmit the generated presentation data 114 to the userdevice 104. The system 102 may further control the user device 104 torender the generated presentation data 114 for the user 112. Detailsabout the presentation data 114 are provided, for example, in FIG. 7 .It may be noted that the presentation data 114 (i.e. indicating theinefficiencies between activities, root causes (like “reassignments”),impacts, and suggestions) shown in FIG. 1 is merely an example. Based ontype of process of the organization, the presentation data 114 may vary,without any deviation from the scope of the disclosure.

FIG. 2 is a block diagram of a system for root cause analysis based onprocess optimization data, in accordance with an embodiment of thedisclosure. FIG. 2 is explained in conjunction with elements from FIG. 1. With reference to FIG. 2 , there is shown a block diagram 200 of thesystem 102. The system 102 may include processor 202, a memory 204, aninput/output (I/O) device 206, and a network interface 208. In someembodiments, the system 102 may communicate with the user device 104 andthe server 108, via the network interface 208. In some otherembodiments, the system 102 may include the first ML model 106 (forexample in the memory 204).

The processor 202 may include suitable logic, circuitry, and/orinterfaces that may be configured to execute instructions for root causeanalysis based on process optimization data. The operations for the rootcause analysis may include, but are not limited to, reception of the logdata of activities, determination of state of inefficiencies in theactivities, application of the first ML model 106, determination of thelabels/values for the root causes, or the generation of the presentationdata. Examples of implementation of the processor 202 may include aCentral Processing Unit (CPU), x86-based processor, a ReducedInstruction Set Computing (RISC) processor, an Application-SpecificIntegrated Circuit (ASIC) processor, a Complex Instruction Set Computing(CISC) processor, a Graphical Processing Unit (GPU), co-processors,other processors, and/or a combination thereof.

The memory 204 may include suitable logic, circuitry, code, and/orinterfaces that may be configured to store the instructions executableby the processor 202. The memory 204 may store the received log data,one or more rules to determine the inefficiency, the presentation data114, first set of records of the log data, estimated odds ratio, andimpact scores. In some embodiments, the memory 204 may be configured tostore the first ML model 106. Examples of implementation of the memory204 may include, but are not limited to, Random Access Memory (RAM),Read Only Memory (ROM), Hard Disk Drive (HDD), and/or a Secure Digital(SD) card.

The I/O device 206 may include suitable logic, circuitry, and/orinterfaces that may be configured to receive an input and provide anoutput based on the received input. The I/O device 206 may includevarious input and output devices, which may be configured to communicatewith the processor 202. Examples of the I/O device 206 may include, butare not limited to, a touch screen, a keyboard, a mouse, a joystick, adisplay device, a microphone, or a speaker.

The network interface 208 may include suitable logic, circuitry,interfaces, and/or code that may be configured to enable communicationbetween the system 102, the user device 104, and the server 108 via oneor more communication networks including the communication network 110.The network interface 208 may implement known technologies to supportwired or wireless communication with the one or more communicationnetworks. The network interface 208 may include, but is not limited to,an antenna, a frequency modulation (FM) transceiver, a radio frequency(RF) transceiver, one or more amplifiers, a tuner, one or moreoscillators, a digital signal processor, a coder-decoder (CODEC)chipset, a subscriber identity module (SIM) card, and/or a local buffer.The network interface 208 may communicate via wireless communicationwith networks, such as the Internet, an Intranet, and/or a wirelessnetwork, such as a cellular telephone network, a wireless local areanetwork (LAN) and/or a metropolitan area network (MAN). The wirelesscommunication may use any of a plurality of communication standards,protocols and technologies, such as Long Term Evolution (LTE), GlobalSystem for Mobile Communications (GSM), Enhanced Data GSM Environment(EDGE), wideband code division multiple access (W-CDMA), code divisionmultiple access (CDMA), time division multiple access (TDMA), Bluetooth,Wireless Fidelity (Wi-Fi) (e.120 g., IEEE 802.11a, IEEE 802.11b, IEEE802.11g and/or IEEE 802.11n), voice over Internet Protocol (VoIP),Wi-MAX, a protocol for email, instant messaging, and/or Short MessageService (SMS).

Similar to the system 102, the user device 104 (though not shown in FIG.2 ) may include one or more components including, but not limited to,processor, a memory, a I/O device, and a network interface with similarfunctions. The functions or operations executed by the system 102, asdescribed in FIGS. 1, 3, 4, 5, 6, 7 and 8 , may be performed by theprocessor 202.

FIG. 3 is a diagram that depicts an exemplary flow map of a process, inaccordance with an embodiment of the disclosure. FIG. 3 is explained inconjunction with elements from FIG. 1 , and FIG. 2 . With reference toFIG. 3 , there is shown an exemplary electronic UI 300 that may displayan exemplary flow map of a process (for example, but not limited to, anInformation technology service management (ITSM) process). Withreference to FIG. 3 , there is shown a first UI element 302 that depictsa name of the ITSM process and a flow map 304 that depicts an executionworkflow of the ITSM process.

To visualize the flow map 304, the system 102 may be configured toreceive a user input to create a process model definition associatedwith the ITSM process. The received user input may include, but is notlimited to, a name of the process, a source table for extraction ofhistorical data of the workflow of the ITSM process, and one or moredata filters to be applied on data stored in the source table to extractthe historical data. In an embodiment, the historical data maycorrespond to audit logs associated with a plurality of historicaltraces of the ITSM process. Based on the reception of the first input,the system 102 may be configured to generate the flow map 304 associatedwith the execution workflow of the ITSM process. Specifically, thesystem 102 may apply a mining engine or a mining algorithm on thehistorical data to generate the flow map 304. In an embodiment, thegenerated flow map 304 may correspond to process mining data or processoptimization data associated with the process (for example the ITSMprocess).

The flow map 304 may show a life cycle of the execution workflow of theITSM process. Within the flow map 304, there is further shown a firstnode 306 and a final node 308 of the ITSM process. The first node 306may correspond to a “start” state of the ITSM process and the final node308 may correspond to a “resolved” state (or a final state) of the ITSMprocess. Between the first node 306 and the final node 308, there isfurther shown a set of intermediate nodes such as, but not limited to, afirst intermediate node 310A, a second intermediate node 310B, and athird intermediate node 310C. For example, the first intermediate node310A may correspond to an “assigned” state, the second intermediate node310B may correspond to a “Work in Progress” state, and the thirdintermediate node 310C may correspond to a “Awaiting Caller Info” state.With reference to FIG. 3 , there is further shown a second node 312 thatmay represent an assignment group, such as (but not limited to) “ITSupport—America” assignment group. There is further shown a set ofdirectional arrows 314 connected to at least two nodes of the first node306, the final node 308, the set of intermediate nodes, and the secondnode 312. Each of the set of directional arrows 314 may represent a flow(or a state transition) within the process. Each of the set directionalarrows 314 may represent a numerical value 316 that may depict a countof state transitions between the two nodes connected by thecorresponding arrow. For example, as shown in FIG. 3 , the numericalvalue “399” may indicate that the state of the 399 number of traces ofthe process have been transitioned to “resolved” state by the “ITSupport—America” assignment group. In an embodiment, the first node 306,the final node 308, and each of the set of intermediate nodes, mayrepresent an activity of the process. As another example, the numericalvalue “4.2K” may indicate that that 4200 number of traces have beentransitioned from “Process Start” state to “Assigned” state. Asdiscussed above, the trace may correspond to a sequence of operationsthat may be executed between the first activity (i.e. the “ProcessStart” state) and the second activity (i.e. “Assigned” state) of theprocess. In an embodiment, the sequence of operations may be included inthe first activity and/or in the second activity. As an example, thesequence of operations executed between the “Process start” state andthe “Assigned State” for an IT ticket (i.e. raised by an employee of theorganization) may include, but not limited to, reception of an IT ticketfrom the employee, storing the content of the IT ticket in a table,determination of a category of IT ticket, determination of one or moreagents capable of handling the IT ticket, determination of an agent whois available to work on the IT ticket, updating the allocation tableassociated with the IT ticket, and the like.

With reference to the flow map 304 and as an example, an IT ticket maybe raised by an employee of the organization at time T1. At the time T1,the IT ticket may be at the “start” state (at the first node 306). Attime T2, the IT ticket may be assigned to “IT Support—America”assignment group (at the second node 312) and the state of the ticketmay be changed from the “start” state to the “assigned” state (at thefirst intermediate node 310A). Once an agent (i.e. assigned executive),from the to “IT Support—America” assignment group, picks up the raisedIT ticket, the state of the ticket may be changed from the “assigned”state to the “Work in Progress” state (at the second intermediate node310B). In some embodiments, the IT ticket may be resolved by the agentand the state of the IT ticket may be changed to the “resolved” state.In certain situations, the agent may require some additional informationfrom the employee who raised the IT ticket. In such a scenario, thestate of the IT ticket may be changed to “Awaiting Caller Info” state(at the third intermediate node 310C). Once the employee provides therequired additional information, the state of the IT ticket may changeto the “Work in Progress” state (at the second intermediate node 310B)and then to “Resolved” state after the agent resolves a problemmentioned in the raised IT ticket.

In an embodiment, the system 102 may be configured to render one or moremetrics associated with the state transition. In an embodiment, thesystem 102 may be configured to receive a user input corresponding toselection of a first arrow from the set of directional arrows. Based onthe selection of the first arrow, the system 102 may be configured torender the one or more metrics associated with the state transition. Theone or more metrics may include, but are not limited to, a count oftotal occurrences, a count of unique occurrence, an average transitiontime, a minimum transition time, a maximum transition time and the like.As an example, the one or more metrics associated with the statetransition from “IT Support—America” assignment group to “Resolved”state (i.e. final state) may indicate that the count of totaloccurrences of tickets from the “IT Support—America” assignment group tothe “Resolved” state may be “315”, the count of unique occurrences oftickets from the “IT Support—America” assignment group to the “Resolved”state may be “315”, the average transition time of tickets from the “ITSupport—America” assignment group to the “Resolved” state may be “21”hours, the minimum transition time of tickets from the “ITSupport—Americas” assignment group to the “Resolved” state may be “2”hours, and the maximum transition time of tickets from the “ITSupport—America” assignment group to the “Resolved” state may be “2”days.

In an embodiment, the one or more metrics may indicate the state ofinefficiency between the first activity (or state) and the secondactivity (or state) of the process. For example, the average transitiontime of tickets from the “IT Support—America” assignment group to the“Resolved” state being “21” hours may correspond to a state ofinefficiency between the “IT Support—America” assignment group and the“Resolved” state, considering an expected average transition time (forexample “15” hours) may be lesser than the actual average transitiontime (i.e. “21” hours). It may be noted that one or more metrics (suchas count of total occurrences of tickets) shown in FIG. 3 are merelypresented as example. The flow map 304 of different types of processesmay indicate various types of metrics, without any deviation from thescope of the disclosure. Different types of metrics may indicatedifferent types of problems/issues (like state of inefficiency) fordifferent processes.

In an embodiment, the exemplary flow map of the process (as shown inFIG. 3 for example) may render a user interface (UI) element (such as aUI button) for root cause analysis, along with the one or more metrics.Based on the selection of the UI element, the system 102 may beconfigured to determine the root cause for the correspondingproblem/issue (such as state of inefficiency) between differentactivities/states (for example the “IT Support—America” assignment groupand the “Resolved” state) by an application of the first ML model 106 onthe traces associated with the activities/states (for example “ITSupport—America” assignment group to the “Resolved” state). The tracesmay correspond to the sequence of operations (or steps orcommunications) for different IT tickets (or for other tasks) betweendifferent activities/states (i.e. IT Support—America” assignment groupand “Resolved” state as shown, for example, in FIG. 3 ) in a particularperiod of time (for example in last certain hours, days, weeks, months,or years).

FIG. 4 depicts a block diagram that illustrates a set of operations forroot cause analysis based on process optimization data, in accordancewith an embodiment of the disclosure. FIG. 4 is explained in conjunctionwith elements from FIG. 1 , FIG. 2 , and FIG. 3 . With reference to FIG.4 , there is shown a block diagram 400 of a set of exemplary operationsfrom 402 to 410. The exemplary operations illustrated in the blockdiagram 400 may be performed by any system, such as by the system 102 ofFIG. 1 or by the processor 202 of FIG. 2 . In an embodiment, a first setof operations (such as operations at 402 404, 408, and 410) of theexemplary operations may be performed by the system 102 of FIG. 1 and asecond set of operations (such as operations at 406A, 406B, 406C, and406D) of the exemplary operations may be performed by the first ML model106 of FIG. 1 . In an embodiment, the first ML model 106 may be includedor stored in the system 102.

At 402, a data acquisition operation may be executed. In the dataacquisition operation, the processor 202 may be configured to receivelog data associated with a first trace between a first activity (or afirst state) and a second activity (or a second state) of the process.The log data may be received from a plurality of data sources. In anembodiment, the system 102 may be configured to receive a first userinput from the user 112, via the user device 104. The received firstuser input may correspond to a selection of one or more data sources(for example the server 108) from the plurality of data sources. Each ofthe plurality of data sources may store log data associated with the oneor more historical traces of the first activity and the second activity(or multiple activities) of the process. In some embodiments, the logdata associated with the historical traces of the first activity and thesecond activity may be stored in the memory 204 of the system 102.

Based on the reception of the first user input, the processor 202 may beconfigured to transmit a data acquisition request to the one or moredata sources. The data acquisition request may correspond to a requestfor the retrieval of the log data from the one or more data sources. Inan embodiment, the data acquisition request may include a first traceidentifier, a first activity identifier, and a second activityidentifier to retrieve the log data associated with the first tracebetween the first activity and the second activity of the process. Basedon the transmission of the data acquisition request, the system 102 maybe further configured to receive the log data, associated with the firsttrace, from the one or more data sources. In an embodiment, the system102 may be configured to receive the log data based on a selection of adirectional arrow (such as the direction arrow 314) in the flow map 304.As an example, the system 102 may receive a user input for selection ofthe directional arrow 314 between the “IT Support—America” assignmentgroup node and the “Resolved” node. The system 102 may further receivethe log data associated with the first execution trace between the “ITSupport—America” assignment group node and the “Resolved” node.

In an embodiment, a trace may be defined as a partially ordered set ofsteps or events (or a sequence of operations or events) that may becharacterized by the step or event name, a start/end time of thestep/event and a duration of the step/event. Each trace of the processmay have a same process identifier and a trace identifier. In anotherembodiment, the process may be an incident and the associated tracewithin the process may be considered as a lifecycle of one incident.

The received log data may include, but is not limited to, a first set ofrecords, a first set of logs, and a first set of user events associatedwith the first trace between the first activity and the second activity.In an embodiment, the first set of records may include the first set oflogs, and the first set of user events associated with the first tracebetween the first activity and the second activity. In an embodiment,the first set of user events may indicate user-related operations in theprocess (such as data inputs, clicks for any particular operation in theprocess, like ticket assignment, ticket approval, ticket rejection,ticket closure, etc in the ITSM process), and the first set of logs mayinclude audit logs (or event logs) associated with the first activityand the second activity of the process. In an embodiment, each of theset of records may correspond to an incident (or a support request or asupport ticket) and may have one or more data fields (or attributes).Each record may be generated when the incident (or a support request)may be raised by an employee of an organization.

In an embodiment, the received first user input may correspond toselection of a first arrow (as shown in FIG. 4 at 304) of the set ofdirectional arrows 314 displayed on the flow map 304. Based on theselection of the first arrow of the set of directional arrows 314, thesystem 102 may be configured to determine the first activity as theactivity from where the first arrow initiates (like from the “ITSupport—America” assignment group node shown in FIG. 3 ) and the secondactivity as the activity where the first arrow terminates (like the“Resolved” node shown in FIG. 3 ).

At 404, an inefficiency determination operation may be performed. In theinefficiency determination operation, the system 102 may be configuredto determine a state of inefficiency between the first activity and thesecond activity of the process. The state of inefficiency between thefirst activity and the second activity may be determined based on aplurality of criteria related to, but not limited to, a time period, aloop count, a state transition count, and a re-assignment count. Forexample, if the time taken between the first activity and the secondactivity of the process is greater than a threshold time period, thenthe state of inefficiency may be determined between the first activityand the second activity. As another example, if the process loops backto same activity for a number of times greater than a threshold count,then the state of inefficiency may be determined between the firstactivity and the second activity. As another example, if the processgoes back to the first activity after the second activity for a numberof times greater than a threshold state transition count, then the stateof inefficiency may be determined between the first activity and thesecond activity. Similarly, if the process flow is being assigned tosame assignment group for a number of times greater than a thresholdre-assignment count, then the state of inefficiency may be determinedbetween the first activity and the second activity.

In an embodiment, the system 102 may be configured to apply one or morerules on the received log data. The one or more rules may be associatedwith the plurality of criteria. Specifically, the one or more rules mayimplement the plurality of criteria. The system 102 may be furtherconfigured to determine the state of inefficiency between the firstactivity and the second activity based on the application of the one ormore rules on the received log data.

At 406, a ML model application operation may be executed. In the MLmodel application operation, the system 102 may be configured to applythe first ML model 106 on the received log data. The first ML model 106may be applied on the log data to determine a first label and a firstvalue (i.e. or classes) to be associated with the first trace of theprocess. The first label and the first value may indicate informationabout a root cause for the determined state of inefficiency associatedwith the first trace of the process. For example, the first trace mayrelate to sequence of operations (tasks, events, or communication)between the first activity (like from the “IT Support—America”assignment group node shown in FIG. 3 ) and the second activity (likethe “Resolved” node shown in FIG. 3 ). By way of example and notlimitation, the first label may be “reassignment reason” (i.e. rootcause for the inefficiency due to the reassignment of raised ticket/taskfrom one worker to another worker) and the first value may be, but notlimited to, “wrong assignment”, “reassignment due to workerunavailability”, reassignment due to escalation”, or “reassignment to beable to work 24/7 time”. Therefore, the root cause of the inefficiencybetween the first activity and the second activity may be wrongre-assignments of the raised IT ticket. The first ML model 106 may betrained to indicate an association (or mapping) between differentlabels/values (i.e. root causes) and different traces (i.e. indicatingdifferent problems like state of inefficiency) of the process. Thetraining of the first ML model 106 on the association between thelabels/values and the traces of the process is described, for example,in FIG. 6 . The ML model application operation may include 4sub-operations such as a record reconstruction operation, a candidatefields identification operation, an odds ratio estimation operation, andan impact score computation operation to determine the first label andthe first value for the determine state of inefficiency for the firsttrace of the process.

At 406A, a record reconstruction sub-operation may be performed. In therecord reconstruction sub-operation, the system 102 may be configured toreconstruct a first set of records from the received log data. Each ofthe first set of records may correspond to an incident or a supportrequest (like a request for IT support) associated with a trace (likethe first trace) of the process. Specifically, the system 102 may beconfigured to reconstruct values of each of one or more fields of thefirst set of records at an initiation of the records. The system 102 maybe configured to analyze the received log data to determine orreconstruct the values of each of the first set of records. In anembodiment, the system 102 may be configured to reconstruct the valuesof each of the first set of records to determine a causal correlationbetween the values and the determined state of inefficiency (i.e. anoutcome) of the process before the outcome materializes. In someembodiments, the system 102 may be configured to control the first MLmodel 106 to reconstruct the first set of records from the received logdata.

In an embodiment, the one or more fields associated with each of thereconstructed first set of records may include, but not limited to, anassignment group filed, a service field, an assigned-to field, acategory field, a sub-category field, a service offering field, a statefield, a caller field, a priority field, an update field, an updated byfield, as short description field, an active field, an activity duefield, an actual ended field, an actual start field, an additionalassignee field, an additional comments field, an approval field, anapproval history field, an approval set field, a duration field, aresolve time field, a caused by change field, a change request field, anumber field, a opened field, and the like. In an embodiment, values foreach of the one or more fields may be filled by the employee who raisesor initiates the incident or request (for example at the first node 306shown in FIG. 3 ). In another embodiment, values for a set of fields outof the total fields may be provided by the employee. In such scenario,the system 102 or the first ML model 106 may automatically determine thevalues for each of the leftover or remaining fields. In an embodiment,the system 102 may be further configured to select the one or morefields during a set-up phase based on a user input received from theuser 112. In another embodiment, the system 102 may be configured toselect one or more hidden fields (latent variables) that may not beselected by the user 112, but may be potential root cause for thedetermined state of inefficiency.

At 406B, a candidate fields identification sub-operation may beperformed. In the candidate fields identification sub-operation, thesystem 102 may be configured to (or control the first ML model 106) toidentify a first set of candidate fields. Based on the reconstruction ofthe first set of records, the system 102 may be configured to identifythe first set of candidate fields from the reconstructed first set ofrecords. Each of the identified first set of candidate fields maycorrespond to a field whose value may have the causal correlation withthe outcome (i.e. state of inefficiency). A first value of a firstcandidate field of the first set of candidate fields may have the causalcorrelation with the outcome because an existence of the first valuecauses or impacts the outcome. In an embodiment, the system 102 may beconfigured to filter-out (or discards) fields that may not havecategorical values and the fields whose values may be blank to identifythe first set of candidate fields. In an embodiment, a categorical valuemay be associated with a categorical field. The categorical field mayhave a distinct value (for example either yes or no, good or bad, etc.)and may not have a numerical value (like “100”, “200”, etc.) or aconstant value (like value for a name of the process, value for a typeof the process, etc.). Alternatively, the categorical value may belongto (or correspond to) a particular category. This may be done becausethe fields that may not have categorical values and the fields whosevalues are blank, may not have impact on the outcome of the process.Each of the identified first set of candidate fields may be potentialroot cause for the inefficiency between the first activity and thesecond activity. The identified set of candidate fields may becategorical (for example based on the number of distinct values).

In an embodiment, the identified set of candidate fields may include theassignment group filed, the service field, the assigned-to field, thecategory field, the state field, the additional assignee field, theadditional comments field, the approval field, the approval historyfield, the approval set field, the service offering field, the shortdescription field, and the like. In another embodiment, the identifiedset of candidate fields may further include the one or more hiddenfields (latent variables) also.

In an embodiment, each of the identified first set of candidate fieldsmay be a potential candidate for the first label (i.e. root cause) to beassociated with the first trace. The system 102 may be furtherconfigured to determine the values for each of the first set ofcandidate fields that may lead or impact to the outcome. The value ofeach field of each of the reconstructed first set of records may bestored in the memory 204. The first value associated with the firstlabel may be from the stored values of each field of each of thereconstructed first set of records.

At 406C, an odds ratio estimation sub-operation may be performed. In theodds ratio estimation sub-operation, the system 102 may be configured to(or control the first ML model 106 to) estimate an odds ratio associatedwith each value of the identified set of candidate fields and theoutcome. Generally, the odds ratio (“OR”) corresponds to a measure ofassociation between an exposure and the outcome. The “OR” may representthe odds that the outcome will occur given a particular exposure (i.e. afirst value of a first candidate field), compared to the odds of theoutcome occurring in the absence of that particular exposure. The “OR”may be estimated by equation (1), as follows:

$\begin{matrix}{\text{“OR”} = {\frac{a/c}{b/d} = \frac{ad}{bc}}} & (1)\end{matrix}$

Where,

“a”=Number of exposed cases, wherein the number of exposed casescorresponds to a number of records with outcome as “the state ofinefficiency” where the value of the first candidate field is the firstvalue,“b”=Number of exposed non-cases, wherein the number of exposed non-casescorresponds to a number of records with outcome as “the state ofinefficiency” where the value of the first candidate field is differentthan the first value,“c”=Number of unexposed cases, wherein the number of unexposed casescorresponds to a number of records with outcome as “Efficient” or “Sateof Efficiency” where the value of the first candidate field is the firstvalue, and“d”=Number of unexposed non-cases, wherein the number of unexposednon-cases corresponds to a number of records with outcome as “Efficient”or “Sate of Efficiency” where the value of the first candidate field isdifferent than the first value.

The system 102 may further store the estimated odds ratio for everyvalue of each candidate field of each reconstructed first set ofrecords. For example, if the first candidate field (say “category”) havetwo different values like, a first value being “forgotten password” anda second value being “forgotten username”, the first ML model 106 or thesystem 102 may be configured to estimate the odds ratio for both thefirst value and the second value (i.e. “forgotten password” and“forgotten username”) for the candidate field “category”. The estimatedodds ratio may be used to compute an impact score as described below.

At 406D, an impact score computation sub-operation may be performed. Inthe impact score computation sub-operation, the system 102 (or the firstML model 106) may be configured to compute an impact score of each ofthe identified first set of candidate fields. In an embodiment, theimpact score may be computed based on the estimated odds ratio. By wayof example and not limitation, the system 102 may be configured tocompute the impact score based on multiplication of the odds ratio and anumber of records that have co-relation with the outcome. The number ofrecords that have the co-relation with the outcome may correspond to therecords that results into the state of inefficiency for the process. Thesystem 102 may be further configured to sort the identified first set ofcandidate fields based on the corresponding computed impact score, togenerate a sorted list of the first set of candidate fields. The sortedlist may be further transmitted to the user device 104. In anembodiment, a first field on the top of the sorted list may be the firstlabel to be associated with the first trace of the process. The system102 may further determine the first value to be associated with thefirst label based on the stored odds ratio. Specifically, the system 102may determine the first value, as the value corresponding to the firstlabel, that may have the maximum impact on the outcome. By way ofexample and not limitation, the first label may be “reassignment reason”(i.e. root cause) and the first value may be “wrong assignment”.Therefore, the root cause of the inefficiency between the first activityand the second activity may be wrong re-assignments of the raised ITticket (or any other request which requires assignment in the process).

At 408, a model creation operation may be performed. In the modelcreation operation, the system 102 may be configured to create a processoptimization model. The system 102 may be configured to create theprocess optimization model based on the computed impact score for eachof the identified first set of candidate fields. The processoptimization model may include one or more nodes or breakdown fieldsthat have many conditions present in the sorted list. For example, if“category=password reset” and “category=laptop” have a high impactscore, then the system 102 may be configured to create the processoptimization model that may focus on “category” field as the breakdownfield. The system 102 may be further configured to generate a flow map(similar to the flow map 304) that may be focused on different valuesassociated with the “category” field.

At 410, presentation data generation operation may be performed. In thepresentation data generation operation, the system 102 may be configuredto generate the presentation data 114 associated with the determinedstate of inefficiency of the first trace based on the determination ofthe first label and the first value. The system 102 may be furtherconfigured to transmit the generated presentation data 114 on the userdevice 104. In an embodiment, the generated presentation data 114 may betransmitted to the user device 104 for rendering of the generatedpresentation data 114 on the user device 104. Details about thegenerated presentation data are provided, for example, in FIG. 7 .

Thus, the system 102 (using the first ML model 106) may be configured toautomatically detect one or more root causes for inefficiencies withinthe process (for example just based on an input, such as a click of abutton). In some embodiments, the detection of the root causes may betrigged automatically (for example at a predefined schedule time, likeonce in a week or a month). The system 102 may further generate thepresentation data associated with the inefficiencies of the first tracebased on the determination of the first label and the first valuerelated to the detected root cause. Moreover, the system 102 may alsogenerate one or more suggestions to overcome the inefficiencies withinthe process (as described, for example, in FIG. 7 ). Thus, the disclosedsystem may detect the root cause for the inefficiencies in the processesquickly, accurately, and at lesser cost as compared to traditionalhuman-based methodologies.

FIG. 5 depicts a block diagram that illustrates a first set ofoperations for training of the first ML model, in accordance with anembodiment of the disclosure. FIG. 5 is explained in conjunction withelements from FIG. 1 , FIG. 2 , FIG. 3 , and FIG. 4 . With reference toFIG. 5 , there is shown a block diagram 500 of a set of exemplaryoperations from 502A to 502G. The exemplary operations illustrated inthe block diagram 500 may be performed by any system, such as by thesystem 102 of FIG. 1 or by the processor 202 of FIG. 2 .

At 502A, a training data acquisition operation may be performed. In thetraining data acquisition operation, the system 102 may be configured toreceive a training dataset. The training dataset may be received fromthe user 112 via the user device 104 and may include a set of trainingrecords, a set of training logs, and a set of user events associatedwith the process. In another embodiment, the training dataset may bereceived from the server 108 related to the process. As discussed above,each record of the set of training records may be associated with anincident or a service request or a support ticket that may be raised byan employee of the organization (including the process) and may includea plurality of fields (or attributes). The received log data correspondto event logs (or audit logs) associated with an execution workflow ofthe process. The set of user events may be associated with user eventsand user context.

At 502B, a language model building operation may be executed. In thelanguage model building operation, the system 102 may be configured tobuild a language model. The language model may be a probabilitydistribution over words or word sequence. In other words, the languagemodel may be able to predict a next word or words in the word sequencebased on one or more preceding words in the word sequence. The languagemodel may be used to detect the root cause for the outcome (i.e. thestate of inefficiency) in a natural language and present the same to theuser 112. The language models may interpret the word sequence by feedingthe word sequence through one or more algorithms that may be responsiblefor creation of rules for the context in a natural language. Theselanguage model may be built for the prediction of words by learning thefeatures and characteristics of a language. With the learning, thelanguage model may prepare itself for understanding phrases andpredicting the next words in word sequence. Examples of different typesof language models may include, but are not limited to, a statisticallanguage model, and neural language model. The statistical languagemodels may use traditional statistical techniques such as N-gram, hiddenmarkov models (HMM) and linguistic rules to learn the probability ofdistribution of the words. The neural language model may use one or moreneural networks to learn the probability of distribution of the words.Examples of statistical language models may include, but are not limitedto, a N-Gram model, a Unigram model, a Bidirectional model, anExponential model, and a continuous space model.

At 502C, an events identification operation may be performed. In theevents identification operation, the system 102 may be configured toidentify one or more first events of interest from the received trainingdataset. The one or more first events of interest may be related to theinefficiency between the first activity and the second activity. In anembodiment, the system 102 may be configured to determine the one ormore first events of interest associated with each potential root causeof the inefficiency between the first activity and the second activityof the process. As a first example and not limitation, to identifytraces with too many reassignments from agent to agent (or from oneassignment group to another assignment group) that may be potential signof the inefficiency, the root cause for “too many reassignments” mayhave to be identified. The system 102 may be configured to identify oneor more traces that may be inefficient due to “too many reassignments”and further identify the one or more first events of interest that maylead to the inefficiency. As an example, the one or more first eventsmay include, but are not limited to, missing information in the recordfrom the employee, rejection of a request by a manager, the managerbeing on leave and no other person than the manager may have anauthority to approve the request, request routing between two or moreassignment groups (or agents) for gathering of the missing information.In another embodiment, the system 102 may be further configured toanalyze each of one or more first events to identify the patterns ofidentified traces that may led to the state of inefficiency in theprocess.

At 502D, a records reconstruction operation may be performed. In therecords reconstruction operation, the system 102 may be configured toreconstruct a second set of records (i.e. from the first set of records)associated with each of the identified one or more first events ofinterest. Specifically, the system 102 may be configured to reconstructa trace of the process based on analysis of a set of records, and a setof logs associated with each of the identified one or more first events.The reconstructed second set of records may correspond to the state ofinefficiency as identified as the one or more first events of interest.In an embodiment, the system 102 may be configured to determine thevalue of one or more fields associated with each trace of the process.In an embodiment, each of the set of records may correspond to anincident or a support request (like a request for IT support) associatedwith the process. Specifically, the system 102 may be configured toreconstruct values of each of one or more fields of the second set ofrecords at an initiation of the records that may have led to the stateof inefficiency in the process. For example, a value of a first field ofthe record was ‘A’ at the time of the initiation of the record, but at acurrent time (i.e. after the execution of any activity of the process),the value of the first record is ‘B’. The system 102 may be configuredto identify the value of the field during the execution of the process.

At 502E, a notes extraction operation may be performed. In the notesextraction operation, the system 102 may be configured to extract one ormore notes associated with each of the reconstructed second set ofrecords. Specifically, the system 102 may be configured to extract afirst conversation between one or more agents (like an IT team worker),and a second conversation between an agent and the employee of theorganization. The system 102 may be further configured to reconstruct athread of conversations from the extracted first conversation and theextracted second conversation. The thread of conversations maycorrespond to the one or more notes associated with each of thereconstructed second set of records. The system 102 may be furtherconfigured to determine a potential cause for “too many reassignments”based on the reconstructed thread of conversations (or the extracted oneor more notes).

In an embodiment, the system 102 may be configured to analyze theidentified events of interest, the reconstructed second set of records,the extracted first conversation, and the extracted second conversationto identify patterns of interest that may lead to outcome (i.e. state ofinefficiency). In an embodiment, the system 102 may be configured toanalyze the identified events of interest, the reconstructed second setof records, the extracted first conversation, and the extracted secondconversation using the built language model. In some embodiments, thepotential fields for the root cause may not be present in thereconstructed traces of the second set of records (and the one or morefields) that may be reconstructed at 502D. With reference to the firstexample, suppose the reason for “too many reassignments” may beassignment to the wrong person but there may be no fields indicating theassignment to the wrong person. In such case, the system 102 may beconfigured to generate a new field (or new categorical field) with labelcalled “assignment correctness” with value either “yes” or “no”. Suchnew field may be generated by the language model based on the analysisof the identified events of interest, the reconstructed second set ofrecords, the extracted first conversation, and the extracted secondconversation. In some embodiments, these new fields may be referred aslatent dimensions or latent variable or hidden variables because thesefields may not be present in the one or more fields but may be thepotential candidate for the inefficiency of the process.

At 502F, a model training operation may be performed. In the modeloperation, the system 102 may be configured to train the first ML model106. Specifically, the system 102 may be configured to apply the firstML model 106 on at least one of the reconstructed second set of recordsor the extracted one or more notes, and determine a first output basedon the application of the first ML model 106 on at least one of thereconstructed second set of records or the extracted one or more notes.The first output may correspond to one or more labels and one or morevalues for the one or more first events of interest. The system 102 maybe further configured to train the first ML model 106 further based onthe determined first output. The training of the first ML model 106 mayinvolve a set of operations that are described, for example, at FIG. 6 .

At 502G, a model output operation may be performed. In the model outputoperation, the system 102 may be configured to output (or deploy) thetrained first ML model 106. The outputted first ML model 106 may betrained to assign the first label and the first value for each trace ofthe process. The first label and the first value for each trace may beassociated with two or more activities of the process. As an example,the first ML model 106 may generate the first label and the first valueto be associated with the inefficiencies between the “ITSupport—America” state, and the “Resolved” state of the flow map 304(shown in FIG. 3 ). In an embodiment, the sub-operations from 406A to406D may be performed by the trained first ML model 106.

In an embodiment, the system 102 may be configured to output a set ofhidden labels and a set of values for each of the set of hidden labelsalong with the trained ML model. The set of hidden labels may begenerated based on the analysis of the identified events of interest,the reconstructed second set of records, the extracted firstconversation, and the extracted second conversation. In anotherembodiment, the system 102 may be configured to assign a first hiddenlabel, from the set of hidden labels, and a corresponding hidden valueto each trace of the process, wherein the first hidden label andassociated first hidden value may indicate information about a rootcause for the determined state of inefficiency between correspondingactivities of the process. For example, if a job or a ticket in theprocess may be re-assigned from one agent to another agent and thus maybe creating the inefficiencies, the first hidden label that may beassigned to the trace associated with each re-assignment may be“Re-assignment Reason”, and the first hidden value may be “Due to WorkerUn-availability”, or “Assigned by Mistake”, or “Due to Escalation” orthe like.

FIG. 6 depicts a block diagram that illustrates a second set ofoperations for training of the first ML model of FIG. 5 , in accordancewith an embodiment of the disclosure. FIG. 6 is explained in conjunctionwith elements from FIG. 1 , FIG. 2 , FIG. 3 , FIG. 4 , and FIG. 5 . Withreference to FIG. 6 , there is shown a block diagram 600 of a set ofexemplary operations from 602A to 602F. The exemplary operationsillustrated in the block diagram 600 may be performed by any system,such as by the system 102 of FIG. 1 or by the processor 202 of FIG. 2 .

At 602A, a model application operation may be performed. In the modelapplication operation, the system 102 may be configured to apply thefirst ML model 106 on each trace of plurality of traces of the processin the training dataset. The first ML model 106 may be configured toassign a label (like root cause) and a first value to one or more tracesof the set of training records. In a first instance, the first ML model106 may randomly assign labels and values to one or more traces in theprocess. With re-training, an accuracy of the first ML model 106 mayincrease and hence the first ML model may assign (or associate) correctlabels and values with each trace of the process. In the re-training ofthe first ML model 106, the system 102 may be configured to execute theoperations from 602A to 602E until a second admin input 606 may bereceived. The system 102 may be configured to re-train the first MLmodel 106 on each trace of a plurality of traces of the process in thetraining dataset.

At 602B, a record identification operation may be performed. In therecord identification operation, the system 102 may be configured toidentify a third set of records. The system 102 may identify the thirdset of records from the second set of records. The identified third setof records may correspond to records that may be unclassified (i.e. ornot mapped with any label related to root cause) to one or more tracesrelated to activities or states in the process. Specifically, the system102 may be configured to eliminate (or exclude) one or more recordsassociated with the one or more traces from the set of training records,to identify the third set of records.

At 602C, a record clustering operation may be performed. In the recordclustering operation, the system 102 may be configured to cluster orgroup one or more records of the identified third set of records, thatmay have similar values of one or more fields, into a set of clusters.Each cluster may include one or more records of the identified third setof records. Also, each of the identified third set of records may be apart of at most one cluster of the set of clusters.

At 602D, a first cluster identification operation may be performed. Inthe first cluster identification operation, the system 102 may beconfigured to detect a first cluster from the set of clusters. The firstcluster may have a maximum density of records among the set of clusters.Each record in the first cluster may have similar values for most of thefields or attributes associated with the records in the first cluster.

At 602E, a first cluster labelling operation may be performed. In thefirst cluster labelling operation, the system 102 may be configuredassign a label and a value to each record within the first cluster. Inan embodiment, the system 102 may be configured to assign the label andthe value (i.e. say assigned by the first ML model 106) to each recordin the identified first cluster. The assigned label and the assignedvalue may be associated with the root cause of the inefficiencies in theprocess. For example, the first cluster may contain records (i.e. ortraces) that may have many re-assignments between multiple agents andtherefore may be inefficient. For such cluster, the assigned label bythe administrator may be “Reassignment Reason”, and the value may be,but is not limited to, “Error”, “organic reassignment”, “reassigning dueto escalation”. In an embodiment, one or more clusters may be assignedwith same label, but each of such one or more clusters may havedifferent values. For example, a first cluster, a second cluster, and athird cluster may have same label (say “Reassignment Reason”), but thevalue assigned to the first cluster may be “Error”, the value assignedto the second cluster may be “organic reassignment”, and the valueassigned to the third cluster may be “reassigning due to escalation”. Inan embodiment, the assigned label and the assigned value may be correct.In such scenarios, the system 102 may proceed to 602F.

In an embodiment, the assigned label and the assigned value may not becorrect. In such scenario, an administrator of the system 102 (or theuser 112) may be required to manually correct the label and the valuefor certain records in the first cluster. The system 102 may beconfigured to receive a first admin input 604 from the administrator viaan electronic device associated with the administrator or via the I/Odevice 206 (shown in FIG. 2 ) of the system 102. The first admin input604 may include a label and a value to be assigned to the detected firstcluster. Based on the reception of the first admin input 604, the system102 may be configured to assign the label and the value to particularrecords (or to each record) present in the detected first cluster.Therefore, the disclosed system may also include human inputs (or keephumans in the loop) during the training of the first ML model 106 as thehuman may be able to assign a label and a value that may correctlydefine the root cause of the inefficiency at least in a first iterationof the training of the first ML model 106. It may be noted that as acount of iterations increases, an accuracy of the first ML model 106 inpredicting the correct labels and values may also increase.

In an embodiment, the system 102 may be configured to perform the stepsfrom 602A to 602E (or re-train the first ML model 106) until the secondadmin input 606 is received. The second admin input 606 may beassociated with stopping the training of the first ML model 106. In anembodiment, the second admin input 606 may be received after theadministrator is satisfied that the records are being assigned withcorrect labels and correct values by the first ML model 106. Until theadministrator is not satisfied with the assigned labels and values, thesystem 102 may again perform the steps from 602A to 602E for thetraining or re-training of the first ML model 106. At 602F, the system102 may be further configured to stop the training of the first ML modelbased on the reception of the second admin input 606.

FIG. 7 is a diagram that displays an exemplary presentation data, inaccordance with an embodiment of the disclosure. FIG. 7 is described inconjunction with elements from FIGS. 1, 2, 3, 4, 5, and 6 . Withreference to FIG. 7 , there is shown an exemplary electronic userinterface (UI) 700. The exemplary electronic UI 700 may be displayed onthe user device 104 associated with the user 112. With reference to FIG.0.7 , there is further shown presentation data 702 that may be displayedon the exemplary electronic UI 700.

The system 102 may be configured to receive the log data associated withfirst trace between the first activity and the second activity of theprocess. The system 102 may be further configured to determine the stateof inefficiency between the first activity and the second activity basedon the received log data. Based on the determination of theinefficiency, the system 102 may be configured to apply the first MLmodel 106 on the received log data. The system 102 may be furtherconfigured to determine the first label and the first value to beassociated with the first trace of the process based on the applicationof the first ML model as described, for example, in FIG. 4 . The firstlabel and the first value may indicate information about the root causefor the determined state of inefficiency. The system 102 may be furtherconfigured to generate the presentation data 702 associated with thedetermined state of inefficiency of the first trace based on thedetermination of the first label and the first value and furthertransmit the generated presentation data 702 on the user device 104. Theuser device 104 may be configured to receive the presentation data 702and further display the received presentation data 702 on the exemplaryelectronic UI 700 rendered on a display screen of the user device 104.

With reference to FIG. 7 , there shown a first UI element 704 that maybe divided into a set of sections (but not limited to) such as a firstsection 704A, a second section 704B, and a third section 704C. The firstUI element 704 may be a textbox and the presentation data 702 may bedisplayed within the first UI element 704. In another embodiment, thegenerated presentation data 702 may further include one or more rootcauses for the determined state of inefficiency between the firstactivity and the second activity and an impact of the inefficiency onthe process. In an embodiment, the one or more root causes and one ormore metrics associated with the root causes may be displayed within thefirst section 704A of the first UI element 704. By way of example, theroot cause for the state of inefficiency between the first activity andthe second activity of the process may be due to “To many reassignments”of one or more records between the first activity and the secondactivity that may have 56% impact on the overall process. In anembodiment, the presentation data 702 may further include the one ormore metrics associated with the determined root cause. For example,(with reference to FIG. 7 ) “18% of cases go through 2+ assignments.”and “Their median calendar duration is 7 times higher.” In anembodiment, the one or more metrics may be displayed based on aselection of each of the one or more metrics during the initializationof the system 102.

In an embodiment, information associated one or more fields withcorresponding values may be a reason for the state of inefficiencybetween the first activity and the second activity. Such information mayalso be included in the generated presentation data 702 and may bedisplayed within the second section 704B of the first UI element 704 asshown, for example, in FIG. 7 .

In an embodiment, the generated presentation data 702 may furtherinclude one or more suggestions to overcome the inefficiency between thefirst activity and the second activity in future. For example, thesystem 102 may be configured to generate a process optimization modelthat may provide one or more suggestions to overcome the inefficiencybetween the first activity and the second activity. The processoptimization model may be viewed based on the selection of a second UIelement 706 (for example a hyperlink). In an embodiment, the one or moresuggestions may also be present within the presentation data 702 and maybe displayed within the third section 704C of the first UI element 704as shown, for example, in FIG. 7 . In an embodiment, details aboutimplementation of the one or more suggestions (such as “auto-route casesleading to an x % reduction of this problem”) may be displayed based onselection of a third UI element 708 as shown, for example, in FIG. 7 .

FIG. 8 is a flowchart that illustrates an exemplary method for rootcause analysis based on process optimization data, in accordance with anembodiment of the disclosure. FIG. 8 is described in conjunction withelements from FIGS. 1, 2, 3, 4, 5, 6, and 7 . With reference to FIG. 8 ,there is shown a flowchart 800. The exemplary method of the flowchart800 may be executed by any computing system, for example, by the system102 of FIG. 1 or FIG. 2 . The exemplary method of the flowchart 800 maystart at 802 and proceed to 804.

At 804, the log data associated with the first trace between the firstactivity and the second activity of the process may be received. Thefirst trace may correspond to the sequence of operations (or tasks)executed between the first activity and the second activity of theprocess. In one or more embodiments, the system 102 may be configured toreceive the log data associated with the first trace between the firstactivity and the second activity of the process Details about thereception of the log data are provided, for example, in FIG. 1 , FIG. 3, and FIG. 4 (at 402).

At 806, the state of inefficiency between the first activity and thesecond activity may be determined. The state of inefficiency may bedetermined based on the received log data. In one or more embodiments,the system 102 may be configured to determine the state of inefficiencybetween the first activity and the second activity based on the receivedlog data. Details about the determination of the state of inefficiencyare provided, for example, in FIG. 4 (at 404).

At 808, the first machine learning (ML) model 106 may be applied on thereceived log data. The first ML model may be applied based on thedetermined state of inefficiency. In one or more embodiments, the system102 may be configured to apply the first ML model 106 on the receivedlog data based on the determined state of inefficiency. Details aboutthe application of the first ML model 106 are provided, for example, inFIG. 4 (at 406).

At 810, the first label and the first value to be associated with thefirst trace of the process may be determined. The first label and thefirst value may be determined based on the application of the first MLmodel 106. The first label and the first value may indicate informationabout the root cause for the determined state of inefficiency. In one ormore embodiments, the system 102 may be configured to determine thefirst label and the first value to be associated with the first trace ofthe process based on the application of the first ML model. Detailsabout the determination of the first label and the first value areprovided, for example, in FIG. 4 (at 406) and FIG. 5 .

At 812, the presentation data 114 associated with the determined stateof inefficiency of the first trace may be generated. The presentationdata 114 may be generated based on the determination of the first labeland the first value. In one or more embodiments, the system 102 may beconfigured to generate the presentation data 114 associated with thedetermined state of inefficiency of the first trace based on thedetermination of the first label and the first value. Details about thepresentation data 114 are provided, for example, in FIG. 7 .

At 814, the generated presentation data 114 may be transmitted to theuser device 104. In one or more embodiments, the system 102 may beconfigured to transmit the generated presentation data 114 on the userdevice 104. In some embodiments, the system 102 may control the userdevice 104 to render the generated presentation data 114 as shown, forexample, in FIG. 7 . Control may pass to end.

Although the flowchart 800 is illustrated as discrete operations, suchas 804, 806, 808, 810, 812, and 814, the disclosure is not so limited.Accordingly, in certain embodiments, such discrete operations may befurther divided into additional operations, combined into feweroperations, or eliminated, depending on the particular implementationwithout detracting from the essence of the disclosed embodiments.

Various embodiments of the disclosure may provide a non-transitorycomputer-readable medium and/or storage medium having stored thereon,computer-executable instructions executable by a machine and/or acomputer to operate a computing system (e.g., the system 102) for rootcause analysis based on process optimization data. Thecomputer-executable instructions may cause the machine and/or computerto perform operations that include reception of log data associated witha first trace between a first activity and a second activity of aprocess. The first trace may correspond to a sequence of operationsexecuted between the first activity and the second activity of theprocess. The operations further include determination of a state ofinefficiency between the first activity and the second activity based onthe received log data. The operations further include application of afirst machine learning (ML) model (such as the first ML model 106) onthe received log data based on the determined state of inefficiency. Theoperations may further include determination of a first label and afirst value to be associated with the first trace of the process basedon the application of the first ML model. The first label and the firstvalue may indicate information about a root cause for the determinedstate of inefficiency. The operations may further include generation ofpresentation data (such as the presentation data 114) associated withthe determined state of inefficiency of the first trace based on thedetermination of the first label and the first value. The operations mayfurther include transmission of the generated presentation data on auser device (such as the user device 104).

The present disclosure is not to be limited in terms of the particularembodiments described in this application, which are intended asillustrations of various aspects. Many modifications and variations canbe made without departing from its scope, as will be apparent to thoseskilled in the art. Functionally equivalent methods and apparatuseswithin the scope of the disclosure, in addition to those describedherein, will be apparent to those skilled in the art from the foregoingdescriptions. Such modifications and variations are intended to fallwithin the scope of the appended claims.

The above detailed description describes various features and operationsof the disclosed systems, devices, and methods with reference to theaccompanying figures. The example embodiments described herein and inthe figures are not meant to be limiting. Other embodiments can beutilized, and other changes can be made, without departing from thescope of the subject matter presented herein. It will be readilyunderstood that the aspects of the present disclosure, as generallydescribed herein, and illustrated in the figures, can be arranged,substituted, combined, separated, and designed in a wide variety ofdifferent configurations.

With respect to any or all of the message flow diagrams, scenarios, andflow charts in the figures and as discussed herein, each step, block,and/or communication can represent a processing of information and/or atransmission of information in accordance with example embodiments.Alternative embodiments are included within the scope of these exampleembodiments. In these alternative embodiments, for example, operationsdescribed as steps, blocks, transmissions, communications, requests,responses, and/or messages can be executed out of order from that shownor discussed, including substantially concurrently or in reverse order,depending on the functionality involved. Further, more or fewer blocksand/or operations can be used with any of the message flow diagrams,scenarios, and flow charts discussed herein, and these message flowdiagrams, scenarios, and flow charts can be combined with one another,in part or in whole.

A step or block that represents a processing of information cancorrespond to circuitry that can be configured to perform the specificlogical functions of a herein-described method or technique.Alternatively, or additionally, a step or block that represents aprocessing of information can correspond to a module, a segment, or aportion of program code (including related data). The program code caninclude one or more instructions executable by a processor forimplementing specific logical operations or actions in the method ortechnique. The program code and/or related data can be stored on anytype of computer readable medium such as a storage device including RAM,a disk drive, a solid-state drive, or another storage medium.

The computer readable medium can also include non-transitory computerreadable media such as computer readable media that store data for shortperiods of time like register memory and processor cache. The computerreadable media can further include non-transitory computer readablemedia that store program code and/or data for longer periods of time.Thus, the computer readable media may include secondary or persistentlong-term storage, like ROM, optical or magnetic disks, solid statedrives, compact-disc read only memory (CD-ROM), for example. Thecomputer readable media can also be any other volatile or non-volatilestorage systems. A computer readable medium can be considered a computerreadable storage medium, for example, or a tangible storage device.

Moreover, a step or block that represents one or more informationtransmissions can correspond to information transmissions betweensoftware and/or hardware modules in the same physical device. However,other information transmissions can be between software modules and/orhardware modules in different physical devices.

The particular arrangements shown in the figures should not be viewed aslimiting. It should be understood that other embodiments can includemore or less of each element shown in a given figure. Further, some ofthe illustrated elements can be combined or omitted. Yet further, anexample embodiment can include elements that are not illustrated in thefigures. While various aspects and embodiments have been disclosedherein, other aspects and embodiments will be apparent to those skilledin the art. The various aspects and embodiments disclosed herein are forpurpose of illustration and are not intended to be limiting, with thetrue scope being indicated by the following claims.

The present disclosure may be realized in hardware, or a combination ofhardware and software. The present disclosure may be realized in acentralized fashion, in at least one computer system, or in adistributed fashion, where different elements may be spread acrossseveral interconnected computer systems. A computer system or otherapparatus adapted to carry out the methods described herein may besuited. A combination of hardware and software may be a general-purposecomputer system with a computer program that, when loaded and executed,may control the computer system such that it carries out the methodsdescribed herein. The present disclosure may be realized in hardwarethat includes a portion of an integrated circuit that also performsother functions.

The present disclosure may also be embedded in a computer programproduct, which includes all the features that enable the implementationof the methods described herein, and which when loaded in a computersystem is able to carry out these methods. Computer program, in thepresent context, means any expression, in any language, code ornotation, of a set of instructions intended to cause a system withinformation processing capability to perform a particular functioneither directly, or after either or both of the following: a) conversionto another language, code or notation; b) reproduction in a differentmaterial form.

While the present disclosure is described with reference to certainembodiments, it will be understood by those skilled in the art thatvarious changes may be made, and equivalents may be substituted withoutdeparture from the scope of the present disclosure. In addition, manymodifications may be made to adapt a particular situation or material tothe teachings of the present disclosure without departure from itsscope. Therefore, it is intended that the present disclosure is notlimited to the particular embodiment disclosed, but that the presentdisclosure will include all embodiments that fall within the scope ofthe appended claims.

What is claimed:
 1. A method, comprising: in a processor: receiving logdata associated with a first trace between a first activity and a secondactivity of a process, wherein the first trace corresponds to a sequenceof operations executed between the first activity and the secondactivity of the process; determining a state of inefficiency between thefirst activity and the second activity based on the received log data;applying a first machine learning (ML) model on the received log databased on the determined state of inefficiency; determining a first labeland a first value to be associated with the first trace of the processbased on the application of the first ML model, wherein the first labeland the first value indicates information about a root cause for thedetermined state of inefficiency; generating presentation dataassociated with the determined state of inefficiency of the first tracebased on the determination of the first label and the first value; andtransmitting the generated presentation data on a user device.
 2. Themethod according to claim 1, wherein the received log data comprises atleast one of: a first set of records, a first set of logs, and a firstset of user events associated with the first trace between the firstactivity and the second activity.
 3. The method according to claim 1,further comprising: applying one or more rules on the received log data;and determining the state of inefficiency between the first activity andthe second activity based on the application of the one or more rules.4. The method according to claim 1, further comprising: receiving afirst user input associated with one or more data sources for retrievalof the log data; transmitting a data acquisition request to the one ormore data sources based on the received first user input; and receivingthe log data from the one or more data sources based on the transmitteddata acquisition request.
 5. The method according to claim 1, furthercomprising: reconstructing a first set of records from the received logdata; identifying a first set of candidate fields based on thereconstruction; estimating an odds ratio associated with each value ofeach of the identified first set of candidate fields and an outcome,wherein the outcome corresponds to the inefficiency between the firstactivity and the second activity; computing an impact score of each ofthe identified first set of candidate fields based on the estimated oddsratio; and generating the presentation data further based on thecomputed impact score.
 6. The method according to claim 1, furthercomprising: receiving a training dataset, wherein the received trainingdata comprises of a set of training records, a set of training logs, anda set of user events associated with the process; identifying one ormore first events of interest from the received training dataset,wherein the one or more first events of interest are related to theinefficiency between the first activity and the second activity;reconstructing a second set of records associated with each of theidentified one or more first events of interest; extracting one or morenotes associated with each of the reconstructed second set of records;applying the first ML model on at least one of the reconstructed secondset of records or the extracted one or more notes; determining a firstoutput based on the application of the first ML model on the at leastone of the reconstructed second set of records or the extracted one ormore notes, wherein the first output corresponds to one or more labelsand one or more values for the one or more first events of interest; andtraining the first ML model based on the received first output.
 7. Themethod according to claim 6, wherein the training of the first ML modelcomprises: identifying a third set of records from the second set ofrecords; clustering the identified third set of records into a set ofclusters; detecting a first cluster from the set of clusters; andreceiving a first admin input from the user device, wherein the firstadmin input includes a label and a value to be associated with thedetected first cluster.
 8. The method according to claim 7, wherein adensity of the detected first cluster is maximum among the density ofeach cluster of the set of clusters.
 9. The method according to claim 7,further comprising: receiving a second admin input associated withstopping the training of the first ML model; and stopping the trainingof the first ML model based on the reception of the second admin input.10. The method according to claim 1, wherein the generated presentationdata further comprises one or more suggestions to overcome theinefficiency between the first activity and the second activity.
 11. Themethod according to claim 1, wherein the generated presentation datafurther comprises one or more root causes for the determined state ofinefficiency between the first activity and the second activity and animpact of the inefficiency on the process.
 12. A non-transitorycomputer-readable storage medium configured to store instructions that,in response to being executed, causes a system to perform operations,the operations comprising: in a processor: receiving log data associatedwith a first trace between a first activity and a second activity of aprocess, wherein the first trace corresponds to a sequence of operationsexecuted between the first activity and the second activity of theprocess; determining a state of inefficiency between the first activityand the second activity based on the received log data; applying a firstmachine learning (ML) model on the received log data based on thedetermined state of inefficiency; determining a first label and a firstvalue to be associated with the first trace of the process based on theapplication of the first ML model, wherein the first label and the firstvalue indicates information about a root cause for the determined stateof inefficiency; generating presentation data associated with thedetermined state of inefficiency of the first trace based on thedetermination of the first label and the first value; and transmittingthe generated presentation data on a user device.
 13. The non-transitorycomputer-readable storage medium according to claim 12, the received logdata comprises at least one of: a first set of records, a first set oflogs, and a first set of user events associated with the first tracebetween the first activity and the second activity.
 14. Thenon-transitory computer-readable storage medium according to claim 12,further comprising: receiving a first user input associated with one ormore data sources for retrieval of the log data; transmitting a dataacquisition request to the one or more data sources based on thereceived first user input; and receiving the log data from the one ormore data sources based on the transmitted data acquisition request. 15.The non-transitory computer-readable storage medium according to claim12, further comprising: reconstructing a first set of records from thereceived log data; identifying a first set of candidate fields based onthe reconstruction; estimating an odds ratio associated with each valueof each of the identified first set of candidate fields and an outcome,wherein the outcome corresponds to the inefficiency between the firstactivity and the second activity; computing an impact score of each ofthe identified first set of candidate fields based on the estimated oddsratio; and generating the presentation data further based on thecomputed impact score.
 16. The non-transitory computer-readable storagemedium according to claim 12, further comprising: receiving a trainingdataset, wherein the received training data comprises of a set oftraining records, a set of training logs, and a set of user eventsassociated with the process; identifying one or more first events ofinterest from the received training dataset, wherein the one or morefirst events of interest are related to the inefficiency between thefirst activity and the second activity; reconstructing a second set ofrecords associated with each of the identified one or more first eventsof interest; extracting one or more notes associated with each of thereconstructed second set of records; applying the first ML model on atleast one of the reconstructed second set of records or the extractedone or more notes; determining a first output based on the applicationof the first ML model on the at least one of the reconstructed secondset of records or the extracted one or more notes, wherein the firstoutput corresponds to one or more labels and one or more values for theone or more first events of interest; and training the first ML modelbased on the received first output.
 17. The non-transitorycomputer-readable storage medium according to claim 16, wherein thetraining of the first ML model comprises: identifying a third set ofrecords from the second set of records; clustering the identified thirdset of records into a set of clusters; detecting a first cluster fromthe set of clusters; and receiving a first admin input from the userdevice, wherein the first admin input includes a label and a value to beassociated with the detected first cluster.
 18. The non-transitorycomputer-readable storage medium according to claim 17, wherein adensity of the detected first cluster is maximum among the density ofeach cluster of the set of clusters.
 19. The non-transitorycomputer-readable storage medium according to claim 12, wherein thegenerated presentation data further comprises one or more suggestions toovercome the inefficiency between the first activity and the secondactivity.
 20. A system, comprising: a processor configured to: receivinglog data associated with a first trace between a first activity and asecond activity of a process, wherein the first trace corresponds to asequence of operations executed between the first activity and thesecond activity of the process; determine a state of inefficiencybetween the first activity and the second activity based on the receivedlog data; apply a first machine learning (ML) model on the received logdata based on the determined state of inefficiency; determine a firstlabel and a first value to be associated with the first trace of theprocess based on the application of the first ML model, wherein thefirst label and the first value indicates information about a root causefor the determined state of inefficiency; generate presentation dataassociated with the determined state of inefficiency of the first tracebased on the determination of the first label and the first value; andtransmit the generated presentation data on a user device.